@yielded/auth 0.1.0-beta.1

package/dist/drizzle/email-model.d.mts

@@ -0,0 +1,352 @@
+import { TokenDigest } from "../Schema.mjs";
+import { AuthenticationRequirement, SecurityRevision } from "../sessions/models.mjs";
+import { LoginIdentifier } from "../identity/models.mjs";
+import { EmailAction, EmailCredentialSnapshot, EmailRegistrationDecision } from "../email/models.mjs";
+import { ProofBinding, ProofContinuationId, ProofPurpose } from "../proofs/models.mjs";
+import { DrizzleMappingError, SubjectIdCodec } from "./model.mjs";
+import { Effect } from "effect";
+import { InferInsertModel, InferSelectModel, SQL, Table } from "drizzle-orm";
+//#region src/drizzle/email-model.d.ts
+type ColumnKey<T extends Table> = Extract<keyof T["_"]["columns"], string>;
+interface EmailSubjectReadTable<Subject extends Table> {
+  readonly table: Subject;
+  readonly id: ColumnKey<Subject>;
+  readonly status: ColumnKey<Subject>;
+  readonly securityRevision: ColumnKey<Subject>;
+  readonly isActiveStatus: (value: unknown) => boolean;
+  readonly d1ActiveStatusValue?: unknown;
+}
+interface EmailSubjectTable<Subject extends Table> extends EmailSubjectReadTable<Subject> {
+  readonly decodeActionRequirement: (row: InferSelectModel<Subject>, action: EmailAction) => Effect.Effect<AuthenticationRequirement, DrizzleMappingError>;
+  readonly nextSecurityRevision?: (current: SecurityRevision) => Effect.Effect<SecurityRevision, DrizzleMappingError>;
+  readonly nextSecurityRevisionSync?: (current: SecurityRevision) => SecurityRevision;
+  readonly d1ActiveStatusValue?: unknown;
+}
+interface EmailIdentifierReadTable<Identifier extends Table> {
+  readonly table: Identifier;
+  readonly namespace: ColumnKey<Identifier>;
+  readonly value: ColumnKey<Identifier>;
+  readonly subjectId: ColumnKey<Identifier>;
+  readonly verifiedAt: ColumnKey<Identifier>;
+  readonly bindingRevision: ColumnKey<Identifier>;
+  readonly isCurrent: (row: InferSelectModel<Identifier>) => boolean;
+}
+interface EmailIdentifierTable<Identifier extends Table, NativeSubjectId> extends EmailIdentifierReadTable<Identifier> {
+  readonly isMutableTarget: (row: InferSelectModel<Identifier>) => boolean;
+  readonly encodeVerifiedInsert: (input: {
+    readonly identifier: LoginIdentifier;
+    readonly subjectId: NativeSubjectId;
+    readonly verifiedAtMillis: number;
+    readonly bindingRevision: SecurityRevision;
+  }) => InferInsertModel<Identifier>;
+  readonly encodeVerification: (input: {
+    readonly verifiedAtMillis: number;
+    readonly bindingRevision: SecurityRevision;
+  }) => Partial<InferInsertModel<Identifier>>;
+  /** Must make the selected source unavailable to sign-in. */
+  readonly encodeRetirement: (input: {
+    readonly source: LoginIdentifier;
+    readonly bindingRevision: SecurityRevision;
+  }) => Partial<InferInsertModel<Identifier>>;
+  readonly d1CurrentCondition?: (input: {
+    readonly identifier: LoginIdentifier;
+    readonly nativeSubjectId: NativeSubjectId;
+    readonly bindingRevision: SecurityRevision;
+  }) => SQL;
+  readonly d1MutableTargetCondition?: (input: {
+    readonly identifier: LoginIdentifier;
+    readonly nativeSubjectId: NativeSubjectId;
+  }) => SQL;
+}
+interface EmailCredentialReadTable<Subject extends Table, Identifier extends Table, Credential extends Table, _NativeSubjectId> {
+  readonly table: Credential;
+  readonly moduleId: ColumnKey<Credential>;
+  readonly subjectId: ColumnKey<Credential>;
+  readonly credentialId: ColumnKey<Credential>;
+  readonly identifierNamespace: ColumnKey<Credential>;
+  readonly identifierValue: ColumnKey<Credential>;
+  readonly credentialRevision: ColumnKey<Credential>;
+  readonly status: ColumnKey<Credential>;
+  readonly isActiveStatus: (value: unknown) => boolean;
+  readonly decode: (input: {
+    readonly moduleId: string;
+    readonly subject: InferSelectModel<Subject>;
+    readonly identifier: InferSelectModel<Identifier>;
+    readonly credential: InferSelectModel<Credential>;
+  }) => Effect.Effect<EmailCredentialSnapshot, DrizzleMappingError>;
+}
+interface EmailCredentialTable<Subject extends Table, Identifier extends Table, Credential extends Table, NativeSubjectId> extends EmailCredentialReadTable<Subject, Identifier, Credential, NativeSubjectId> {
+  readonly encodeVerifiedInsert: (input: {
+    readonly moduleId: string;
+    readonly subjectId: NativeSubjectId;
+    readonly credentialId: string;
+    readonly identifier: LoginIdentifier;
+    readonly credentialRevision: SecurityRevision;
+  }) => InferInsertModel<Credential>;
+  readonly encodeActivation: (input: {
+    readonly identifier: LoginIdentifier;
+    readonly credentialRevision: SecurityRevision;
+  }) => Partial<InferInsertModel<Credential>>;
+  readonly encodeRetirement: (input: {
+    readonly source: LoginIdentifier;
+    readonly credentialRevision: SecurityRevision;
+  }) => Partial<InferInsertModel<Credential>>;
+  readonly d1ActiveStatusValue?: unknown;
+}
+interface EmailAuthorityCredentialTable<Credential extends Table, NativeSubjectId> {
+  readonly table: Credential;
+  readonly subjectId: ColumnKey<Credential>;
+  readonly credentialId: ColumnKey<Credential>;
+  readonly revision: ColumnKey<Credential>;
+  readonly status: ColumnKey<Credential>;
+  readonly isActiveStatus: (value: unknown) => boolean;
+  readonly encodeInsert: (input: {
+    readonly subjectId: NativeSubjectId;
+    readonly credentialId: string;
+    readonly revision: SecurityRevision;
+  }) => InferInsertModel<Credential>;
+  readonly encodeActivation: (revision: SecurityRevision) => Partial<InferInsertModel<Credential>>;
+  readonly encodeRetirement: (revision: SecurityRevision) => Partial<InferInsertModel<Credential>>;
+  readonly d1ActiveStatusValue?: unknown;
+}
+interface EmailCommandTable<Command extends Table> {
+  readonly table: Command;
+  readonly moduleId: ColumnKey<Command>;
+  readonly commandId: ColumnKey<Command>;
+  readonly action: ColumnKey<Command>;
+  readonly bindingDigest: ColumnKey<Command>;
+  readonly retentionUntil: ColumnKey<Command>;
+  readonly encodeInsert: (input: {
+    readonly moduleId: string;
+    readonly commandId: string;
+    readonly action: EmailAction;
+    readonly bindingDigest: TokenDigest;
+    readonly retentionUntilMillis: number;
+  }) => InferInsertModel<Command>;
+}
+interface RequiredEmailSignInConstraints {
+  readonly identifier: "unique(identifier.namespace,identifier.value)";
+  readonly credentialId: "unique(emailCredential.moduleId,emailCredential.credentialId)";
+  readonly credentialIdentifier: "unique(emailCredential.moduleId,emailCredential.identifierNamespace,emailCredential.identifierValue)";
+}
+declare const requiredEmailSignInConstraints: RequiredEmailSignInConstraints;
+interface EmailSignInMapping<Subject extends Table, Identifier extends Table, Credential extends Table, NativeSubjectId> {
+  readonly subject: EmailSubjectReadTable<Subject>;
+  readonly identifier: EmailIdentifierReadTable<Identifier>;
+  readonly credential: EmailCredentialReadTable<Subject, Identifier, Credential, NativeSubjectId>;
+  readonly subjectId: SubjectIdCodec<NativeSubjectId>;
+  readonly constraints: RequiredEmailSignInConstraints;
+  readonly decodeInstant: (native: unknown) => Effect.Effect<number, DrizzleMappingError>;
+}
+interface RequiredEmailAddressConstraints extends RequiredEmailSignInConstraints {
+  readonly authorityCredential: "unique(authorityCredential.subjectId,authorityCredential.credentialId)";
+  readonly command: "unique(emailCommand.moduleId,emailCommand.commandId)";
+}
+declare const requiredEmailAddressConstraints: RequiredEmailAddressConstraints;
+interface EmailD1Clock {
+  readonly engineNow: SQL;
+  readonly engineNowMillis: SQL;
+  readonly engineInstantPlus: (millis: number) => SQL;
+}
+interface EmailAddressMapping<Subject extends Table, Identifier extends Table, Credential extends Table, AuthorityCredential extends Table, Command extends Table, NativeSubjectId> extends EmailSignInMapping<Subject, Identifier, Credential, NativeSubjectId> {
+  readonly subject: EmailSubjectTable<Subject>;
+  readonly identifier: EmailIdentifierTable<Identifier, NativeSubjectId>;
+  readonly credential: EmailCredentialTable<Subject, Identifier, Credential, NativeSubjectId>;
+  readonly authorityCredential: EmailAuthorityCredentialTable<AuthorityCredential, NativeSubjectId>;
+  readonly command: EmailCommandTable<Command>;
+  readonly constraints: RequiredEmailAddressConstraints;
+  readonly addressCardinality: "single" | "multiple";
+  readonly changeDisposition: "retire-source";
+  readonly allocateCredentialId?: Effect.Effect<string, DrizzleMappingError>;
+  readonly allocateCredentialIdSync?: () => string;
+  readonly allocateRevision?: Effect.Effect<SecurityRevision, DrizzleMappingError>;
+  readonly allocateRevisionSync?: () => SecurityRevision;
+  readonly encodeInstant: (epochMillis: number) => unknown;
+  readonly commandRetentionMillis: number;
+  readonly sessionInvalidation: "same-authority-immediate" | "original-absolute-expiry";
+  readonly isCommandConflict: (cause: unknown) => boolean;
+  readonly isIdentifierConflict: (cause: unknown) => boolean;
+  readonly isCredentialConflict: (cause: unknown) => boolean;
+  readonly d1?: EmailD1Clock;
+}
+type D1EmailAddressMapping<Subject extends Table, Identifier extends Table, Credential extends Table, AuthorityCredential extends Table, Command extends Table, NativeSubjectId> = EmailAddressMapping<Subject, Identifier, Credential, AuthorityCredential, Command, NativeSubjectId> & {
+  readonly d1: EmailD1Clock;
+  readonly subject: EmailSubjectTable<Subject> & {
+    readonly d1ActiveStatusValue: unknown;
+  };
+  readonly identifier: EmailIdentifierTable<Identifier, NativeSubjectId> & {
+    readonly d1CurrentCondition: NonNullable<EmailIdentifierTable<Identifier, NativeSubjectId>["d1CurrentCondition"]>;
+    readonly d1MutableTargetCondition: NonNullable<EmailIdentifierTable<Identifier, NativeSubjectId>["d1MutableTargetCondition"]>;
+  };
+  readonly credential: EmailCredentialTable<Subject, Identifier, Credential, NativeSubjectId> & {
+    readonly d1ActiveStatusValue: unknown;
+  };
+  readonly authorityCredential: EmailAuthorityCredentialTable<AuthorityCredential, NativeSubjectId> & {
+    readonly d1ActiveStatusValue: unknown;
+  };
+};
+type EmailRegistrationState = "pending" | "registered";
+interface EmailRegistrationIntent<Registration> {
+  readonly moduleId: string;
+  readonly commandId: string;
+  readonly identifier: LoginIdentifier;
+  readonly registration: Registration;
+  readonly fingerprint: TokenDigest;
+  readonly completion: {
+    readonly moduleId: string;
+    readonly purpose: ProofPurpose;
+    readonly continuationId: ProofContinuationId;
+    readonly binding: ProofBinding;
+  };
+}
+interface EmailRegistrationTable<Registration, Request extends Table, NativeSubjectId> {
+  readonly table: Request;
+  readonly moduleId: ColumnKey<Request>;
+  readonly commandId: ColumnKey<Request>;
+  readonly fingerprint: ColumnKey<Request>;
+  readonly state: ColumnKey<Request>;
+  readonly subjectId: ColumnKey<Request>;
+  readonly pendingReference: ColumnKey<Request>;
+  readonly retentionUntil: ColumnKey<Request>;
+  readonly encodeInsert: (input: EmailRegistrationIntent<Registration>, state: {
+    readonly state: EmailRegistrationState;
+    readonly nativeSubjectId?: NativeSubjectId;
+    readonly pendingReference?: string;
+    readonly retentionUntilMillis: number;
+  }) => InferInsertModel<Request>;
+  readonly decodeReplay: (row: InferSelectModel<Request>) => Effect.Effect<Exclude<EmailRegistrationDecision, {
+    readonly _tag: "Registered";
+  }>, DrizzleMappingError>;
+}
+interface EmailRegistrationProvisioning<Registration, Subject extends Table, NativeSubjectId> {
+  readonly encodeSubjectInsert: (input: EmailRegistrationIntent<Registration>, values: {
+    readonly nativeSubjectId: NativeSubjectId | undefined;
+    readonly securityRevision: SecurityRevision;
+  }) => InferInsertModel<Subject>;
+  readonly allocateSubjectId?: Effect.Effect<NativeSubjectId, DrizzleMappingError>;
+  readonly allocateSubjectIdSync?: () => NativeSubjectId;
+  readonly decodeGeneratedId?: (rows: ReadonlyArray<unknown>) => Effect.Effect<NativeSubjectId, DrizzleMappingError>;
+}
+interface EmailRegistrationIdentifierTable<Identifier extends Table, NativeSubjectId> {
+  readonly table: Identifier;
+  readonly namespace: ColumnKey<Identifier>;
+  readonly value: ColumnKey<Identifier>;
+  readonly subjectId: ColumnKey<Identifier>;
+  readonly verifiedAt: ColumnKey<Identifier>;
+  readonly bindingRevision: ColumnKey<Identifier>;
+  readonly isCurrent: (row: InferSelectModel<Identifier>) => boolean;
+  readonly d1CurrentCondition?: (input: {
+    readonly identifier: LoginIdentifier;
+    readonly nativeSubjectId: NativeSubjectId;
+    readonly bindingRevision: SecurityRevision;
+  }) => SQL;
+  readonly encodeVerifiedInsert: (input: {
+    readonly identifier: LoginIdentifier;
+    readonly subjectId: NativeSubjectId;
+    readonly verifiedAtMillis: number;
+    readonly bindingRevision: SecurityRevision;
+  }) => InferInsertModel<Identifier>;
+}
+interface EmailRegistrationCredentialTable<Credential extends Table, NativeSubjectId> {
+  readonly table: Credential;
+  readonly moduleId: ColumnKey<Credential>;
+  readonly subjectId: ColumnKey<Credential>;
+  readonly credentialId: ColumnKey<Credential>;
+  readonly identifierNamespace: ColumnKey<Credential>;
+  readonly identifierValue: ColumnKey<Credential>;
+  readonly credentialRevision: ColumnKey<Credential>;
+  readonly status: ColumnKey<Credential>;
+  readonly isActiveStatus: (value: unknown) => boolean;
+  readonly d1ActiveStatusValue?: unknown;
+  readonly encodeVerifiedInsert: (input: {
+    readonly moduleId: string;
+    readonly subjectId: NativeSubjectId;
+    readonly credentialId: string;
+    readonly identifier: LoginIdentifier;
+    readonly credentialRevision: SecurityRevision;
+  }) => InferInsertModel<Credential>;
+}
+interface EmailRegistrationAuthorityCredentialTable<Credential extends Table, NativeSubjectId> {
+  readonly table: Credential;
+  readonly subjectId: ColumnKey<Credential>;
+  readonly credentialId: ColumnKey<Credential>;
+  readonly revision: ColumnKey<Credential>;
+  readonly status: ColumnKey<Credential>;
+  readonly isActiveStatus: (value: unknown) => boolean;
+  readonly d1ActiveStatusValue?: unknown;
+  readonly encodeInsert: (input: {
+    readonly subjectId: NativeSubjectId;
+    readonly credentialId: string;
+    readonly revision: SecurityRevision;
+  }) => InferInsertModel<Credential>;
+}
+interface RequiredEmailRegistrationConstraints extends RequiredEmailSignInConstraints {
+  readonly authorityCredential: "unique(authorityCredential.subjectId,authorityCredential.credentialId)";
+  readonly request: "unique(emailRegistration.moduleId,emailRegistration.commandId)";
+  readonly pendingReference: "unique(emailRegistration.pendingReference)";
+}
+declare const requiredEmailRegistrationConstraints: RequiredEmailRegistrationConstraints;
+type EmailRegistrationBase<Registration, Request extends Table, NativeSubjectId> = {
+  readonly registration: EmailRegistrationTable<Registration, Request, NativeSubjectId>;
+  readonly constraints: Pick<RequiredEmailRegistrationConstraints, "request" | "pendingReference">;
+  readonly inspect: (input: {
+    readonly identifier: LoginIdentifier;
+    readonly registration: Registration;
+  }) => Effect.Effect<{
+    readonly fingerprint: TokenDigest;
+    readonly eligible: boolean;
+  }, DrizzleMappingError>;
+  /** Projects one detached value of the factory-specific Registration Type. */
+  readonly snapshotRegistration: (registration: Registration) => Effect.Effect<Registration, DrizzleMappingError>;
+  /** Required by synchronous transaction-bound services. */
+  readonly snapshotRegistrationSync?: (registration: Registration) => Registration;
+  /** Required by synchronous Durable Object transaction-bound services. */
+  readonly inspectSync?: (input: {
+    readonly identifier: LoginIdentifier;
+    readonly registration: Registration;
+  }) => {
+    readonly fingerprint: TokenDigest;
+    readonly eligible: boolean;
+  };
+  readonly allocatePendingReference?: Effect.Effect<string, DrizzleMappingError>;
+  readonly allocatePendingReferenceSync?: () => string;
+  readonly encodeInstant: (epochMillis: number) => unknown;
+  readonly retentionMillis: number;
+  readonly isRequestConflict: (cause: unknown) => boolean;
+};
+type EmailRegistrationMapping<Registration, Subject extends Table, Identifier extends Table, Credential extends Table, AuthorityCredential extends Table, Request extends Table, NativeSubjectId> = EmailRegistrationBase<Registration, Request, NativeSubjectId> & ({
+  readonly mode: "atomic";
+  readonly subject: EmailSubjectReadTable<Subject>;
+  readonly identifier: EmailRegistrationIdentifierTable<Identifier, NativeSubjectId>;
+  readonly credential: EmailRegistrationCredentialTable<Credential, NativeSubjectId>;
+  readonly authorityCredential: EmailRegistrationAuthorityCredentialTable<AuthorityCredential, NativeSubjectId>;
+  readonly subjectId: SubjectIdCodec<NativeSubjectId>;
+  readonly constraints: RequiredEmailRegistrationConstraints;
+  readonly allocateCredentialId?: Effect.Effect<string, DrizzleMappingError>;
+  readonly allocateCredentialIdSync?: () => string;
+  readonly allocateRevision?: Effect.Effect<SecurityRevision, DrizzleMappingError>;
+  readonly allocateRevisionSync?: () => SecurityRevision;
+  readonly isIdentifierConflict: (cause: unknown) => boolean;
+  readonly isCredentialConflict: (cause: unknown) => boolean;
+  readonly provisioning: EmailRegistrationProvisioning<Registration, Subject, NativeSubjectId> & ({
+    readonly idMode: "allocated";
+    readonly allocateSubjectId: Effect.Effect<NativeSubjectId, DrizzleMappingError>;
+  } | {
+    readonly idMode: "synchronous";
+    readonly allocateSubjectIdSync: () => NativeSubjectId;
+  } | {
+    readonly idMode: "generated";
+    readonly decodeGeneratedId: (rows: ReadonlyArray<unknown>) => Effect.Effect<NativeSubjectId, DrizzleMappingError>;
+  });
+} | {
+  readonly mode: "pending";
+});
+type AnyEmailSignInMapping = EmailSignInMapping<Table, Table, Table, unknown>;
+type AnyEmailAddressMapping = EmailAddressMapping<Table, Table, Table, Table, Table, unknown>;
+type AnyEmailRegistrationMapping<Registration = unknown> = EmailRegistrationMapping<Registration, Table, Table, Table, Table, Table, unknown>;
+type D1EmailRegistrationMapping<Registration, Subject extends Table, Identifier extends Table, Credential extends Table, AuthorityCredential extends Table, Request extends Table, NativeSubjectId> = EmailRegistrationMapping<Registration, Subject, Identifier, Credential, AuthorityCredential, Request, NativeSubjectId> & {
+  readonly d1: EmailD1Clock;
+};
+//#endregion
+export { AnyEmailAddressMapping, AnyEmailRegistrationMapping, AnyEmailSignInMapping, D1EmailAddressMapping, D1EmailRegistrationMapping, EmailAddressMapping, EmailAuthorityCredentialTable, EmailCommandTable, EmailCredentialReadTable, EmailCredentialTable, EmailD1Clock, EmailIdentifierReadTable, EmailIdentifierTable, EmailRegistrationAuthorityCredentialTable, EmailRegistrationCredentialTable, EmailRegistrationIdentifierTable, EmailRegistrationIntent, EmailRegistrationMapping, EmailRegistrationProvisioning, EmailRegistrationState, EmailRegistrationTable, EmailSignInMapping, EmailSubjectReadTable, EmailSubjectTable, RequiredEmailAddressConstraints, RequiredEmailRegistrationConstraints, RequiredEmailSignInConstraints, requiredEmailAddressConstraints, requiredEmailRegistrationConstraints, requiredEmailSignInConstraints };
+//# sourceMappingURL=email-model.d.mts.map

package/dist/drizzle/email-model.mjs

@@ -0,0 +1,21 @@
+//#region src/drizzle/email-model.ts
+const requiredEmailSignInConstraints = {
+	identifier: "unique(identifier.namespace,identifier.value)",
+	credentialId: "unique(emailCredential.moduleId,emailCredential.credentialId)",
+	credentialIdentifier: "unique(emailCredential.moduleId,emailCredential.identifierNamespace,emailCredential.identifierValue)"
+};
+const requiredEmailAddressConstraints = {
+	...requiredEmailSignInConstraints,
+	authorityCredential: "unique(authorityCredential.subjectId,authorityCredential.credentialId)",
+	command: "unique(emailCommand.moduleId,emailCommand.commandId)"
+};
+const requiredEmailRegistrationConstraints = {
+	...requiredEmailSignInConstraints,
+	authorityCredential: "unique(authorityCredential.subjectId,authorityCredential.credentialId)",
+	request: "unique(emailRegistration.moduleId,emailRegistration.commandId)",
+	pendingReference: "unique(emailRegistration.pendingReference)"
+};
+//#endregion
+export { requiredEmailAddressConstraints, requiredEmailRegistrationConstraints, requiredEmailSignInConstraints };
+
+//# sourceMappingURL=email-model.mjs.map

package/dist/drizzle/email-model.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"email-model.mjs","names":[],"sources":["../../src/drizzle/email-model.ts"],"sourcesContent":["import type { InferInsertModel, InferSelectModel, SQL, Table } from \"drizzle-orm\";\nimport type { Effect } from \"effect\";\n\nimport type { EmailAction, EmailRegistrationDecision } from \"../email/models\";\nimport type { LoginIdentifier } from \"../identity/models\";\nimport type { ProofBinding, ProofContinuationId, ProofPurpose } from \"../proofs/models\";\nimport type { TokenDigest } from \"../Schema\";\nimport type { AuthenticationRequirement, SecurityRevision } from \"../sessions/models\";\nimport type { DrizzleMappingError, SubjectIdCodec } from \"./model\";\n\ntype ColumnKey<T extends Table> = Extract<keyof T[\"_\"][\"columns\"], string>;\n\nexport interface EmailSubjectReadTable<Subject extends Table> {\n  readonly table: Subject;\n  readonly id: ColumnKey<Subject>;\n  readonly status: ColumnKey<Subject>;\n  readonly securityRevision: ColumnKey<Subject>;\n  readonly isActiveStatus: (value: unknown) => boolean;\n  readonly d1ActiveStatusValue?: unknown;\n}\n\nexport interface EmailSubjectTable<Subject extends Table> extends EmailSubjectReadTable<Subject> {\n  readonly decodeActionRequirement: (\n    row: InferSelectModel<Subject>,\n    action: EmailAction,\n  ) => Effect.Effect<AuthenticationRequirement, DrizzleMappingError>;\n  readonly nextSecurityRevision?: (\n    current: SecurityRevision,\n  ) => Effect.Effect<SecurityRevision, DrizzleMappingError>;\n  readonly nextSecurityRevisionSync?: (current: SecurityRevision) => SecurityRevision;\n  readonly d1ActiveStatusValue?: unknown;\n}\n\nexport interface EmailIdentifierReadTable<Identifier extends Table> {\n  readonly table: Identifier;\n  readonly namespace: ColumnKey<Identifier>;\n  readonly value: ColumnKey<Identifier>;\n  readonly subjectId: ColumnKey<Identifier>;\n  readonly verifiedAt: ColumnKey<Identifier>;\n  readonly bindingRevision: ColumnKey<Identifier>;\n  readonly isCurrent: (row: InferSelectModel<Identifier>) => boolean;\n}\n\nexport interface EmailIdentifierTable<\n  Identifier extends Table,\n  NativeSubjectId,\n> extends EmailIdentifierReadTable<Identifier> {\n  readonly isMutableTarget: (row: InferSelectModel<Identifier>) => boolean;\n  readonly encodeVerifiedInsert: (input: {\n    readonly identifier: LoginIdentifier;\n    readonly subjectId: NativeSubjectId;\n    readonly verifiedAtMillis: number;\n    readonly bindingRevision: SecurityRevision;\n  }) => InferInsertModel<Identifier>;\n  readonly encodeVerification: (input: {\n    readonly verifiedAtMillis: number;\n    readonly bindingRevision: SecurityRevision;\n  }) => Partial<InferInsertModel<Identifier>>;\n  /** Must make the selected source unavailable to sign-in. */\n  readonly encodeRetirement: (input: {\n    readonly source: LoginIdentifier;\n    readonly bindingRevision: SecurityRevision;\n  }) => Partial<InferInsertModel<Identifier>>;\n  readonly d1CurrentCondition?: (input: {\n    readonly identifier: LoginIdentifier;\n    readonly nativeSubjectId: NativeSubjectId;\n    readonly bindingRevision: SecurityRevision;\n  }) => SQL;\n  readonly d1MutableTargetCondition?: (input: {\n    readonly identifier: LoginIdentifier;\n    readonly nativeSubjectId: NativeSubjectId;\n  }) => SQL;\n}\n\nexport interface EmailCredentialReadTable<\n  Subject extends Table,\n  Identifier extends Table,\n  Credential extends Table,\n  _NativeSubjectId,\n> {\n  readonly table: Credential;\n  readonly moduleId: ColumnKey<Credential>;\n  readonly subjectId: ColumnKey<Credential>;\n  readonly credentialId: ColumnKey<Credential>;\n  readonly identifierNamespace: ColumnKey<Credential>;\n  readonly identifierValue: ColumnKey<Credential>;\n  readonly credentialRevision: ColumnKey<Credential>;\n  readonly status: ColumnKey<Credential>;\n  readonly isActiveStatus: (value: unknown) => boolean;\n  readonly decode: (input: {\n    readonly moduleId: string;\n    readonly subject: InferSelectModel<Subject>;\n    readonly identifier: InferSelectModel<Identifier>;\n    readonly credential: InferSelectModel<Credential>;\n  }) => Effect.Effect<import(\"../email/models\").EmailCredentialSnapshot, DrizzleMappingError>;\n}\n\nexport interface EmailCredentialTable<\n  Subject extends Table,\n  Identifier extends Table,\n  Credential extends Table,\n  NativeSubjectId,\n> extends EmailCredentialReadTable<Subject, Identifier, Credential, NativeSubjectId> {\n  readonly encodeVerifiedInsert: (input: {\n    readonly moduleId: string;\n    readonly subjectId: NativeSubjectId;\n    readonly credentialId: string;\n    readonly identifier: LoginIdentifier;\n    readonly credentialRevision: SecurityRevision;\n  }) => InferInsertModel<Credential>;\n  readonly encodeActivation: (input: {\n    readonly identifier: LoginIdentifier;\n    readonly credentialRevision: SecurityRevision;\n  }) => Partial<InferInsertModel<Credential>>;\n  readonly encodeRetirement: (input: {\n    readonly source: LoginIdentifier;\n    readonly credentialRevision: SecurityRevision;\n  }) => Partial<InferInsertModel<Credential>>;\n  readonly d1ActiveStatusValue?: unknown;\n}\n\nexport interface EmailAuthorityCredentialTable<Credential extends Table, NativeSubjectId> {\n  readonly table: Credential;\n  readonly subjectId: ColumnKey<Credential>;\n  readonly credentialId: ColumnKey<Credential>;\n  readonly revision: ColumnKey<Credential>;\n  readonly status: ColumnKey<Credential>;\n  readonly isActiveStatus: (value: unknown) => boolean;\n  readonly encodeInsert: (input: {\n    readonly subjectId: NativeSubjectId;\n    readonly credentialId: string;\n    readonly revision: SecurityRevision;\n  }) => InferInsertModel<Credential>;\n  readonly encodeActivation: (revision: SecurityRevision) => Partial<InferInsertModel<Credential>>;\n  readonly encodeRetirement: (revision: SecurityRevision) => Partial<InferInsertModel<Credential>>;\n  readonly d1ActiveStatusValue?: unknown;\n}\n\nexport interface EmailCommandTable<Command extends Table> {\n  readonly table: Command;\n  readonly moduleId: ColumnKey<Command>;\n  readonly commandId: ColumnKey<Command>;\n  readonly action: ColumnKey<Command>;\n  readonly bindingDigest: ColumnKey<Command>;\n  readonly retentionUntil: ColumnKey<Command>;\n  readonly encodeInsert: (input: {\n    readonly moduleId: string;\n    readonly commandId: string;\n    readonly action: EmailAction;\n    readonly bindingDigest: TokenDigest;\n    readonly retentionUntilMillis: number;\n  }) => InferInsertModel<Command>;\n}\n\nexport interface RequiredEmailSignInConstraints {\n  readonly identifier: \"unique(identifier.namespace,identifier.value)\";\n  readonly credentialId: \"unique(emailCredential.moduleId,emailCredential.credentialId)\";\n  readonly credentialIdentifier: \"unique(emailCredential.moduleId,emailCredential.identifierNamespace,emailCredential.identifierValue)\";\n}\n\nexport const requiredEmailSignInConstraints: RequiredEmailSignInConstraints = {\n  identifier: \"unique(identifier.namespace,identifier.value)\",\n  credentialId: \"unique(emailCredential.moduleId,emailCredential.credentialId)\",\n  credentialIdentifier:\n    \"unique(emailCredential.moduleId,emailCredential.identifierNamespace,emailCredential.identifierValue)\",\n};\n\nexport interface EmailSignInMapping<\n  Subject extends Table,\n  Identifier extends Table,\n  Credential extends Table,\n  NativeSubjectId,\n> {\n  readonly subject: EmailSubjectReadTable<Subject>;\n  readonly identifier: EmailIdentifierReadTable<Identifier>;\n  readonly credential: EmailCredentialReadTable<Subject, Identifier, Credential, NativeSubjectId>;\n  readonly subjectId: SubjectIdCodec<NativeSubjectId>;\n  readonly constraints: RequiredEmailSignInConstraints;\n  readonly decodeInstant: (native: unknown) => Effect.Effect<number, DrizzleMappingError>;\n}\n\nexport interface RequiredEmailAddressConstraints extends RequiredEmailSignInConstraints {\n  readonly authorityCredential: \"unique(authorityCredential.subjectId,authorityCredential.credentialId)\";\n  readonly command: \"unique(emailCommand.moduleId,emailCommand.commandId)\";\n}\n\nexport const requiredEmailAddressConstraints: RequiredEmailAddressConstraints = {\n  ...requiredEmailSignInConstraints,\n  authorityCredential: \"unique(authorityCredential.subjectId,authorityCredential.credentialId)\",\n  command: \"unique(emailCommand.moduleId,emailCommand.commandId)\",\n};\n\nexport interface EmailD1Clock {\n  readonly engineNow: SQL;\n  readonly engineNowMillis: SQL;\n  readonly engineInstantPlus: (millis: number) => SQL;\n}\n\nexport interface EmailAddressMapping<\n  Subject extends Table,\n  Identifier extends Table,\n  Credential extends Table,\n  AuthorityCredential extends Table,\n  Command extends Table,\n  NativeSubjectId,\n> extends EmailSignInMapping<Subject, Identifier, Credential, NativeSubjectId> {\n  readonly subject: EmailSubjectTable<Subject>;\n  readonly identifier: EmailIdentifierTable<Identifier, NativeSubjectId>;\n  readonly credential: EmailCredentialTable<Subject, Identifier, Credential, NativeSubjectId>;\n  readonly authorityCredential: EmailAuthorityCredentialTable<AuthorityCredential, NativeSubjectId>;\n  readonly command: EmailCommandTable<Command>;\n  readonly constraints: RequiredEmailAddressConstraints;\n  readonly addressCardinality: \"single\" | \"multiple\";\n  readonly changeDisposition: \"retire-source\";\n  readonly allocateCredentialId?: Effect.Effect<string, DrizzleMappingError>;\n  readonly allocateCredentialIdSync?: () => string;\n  readonly allocateRevision?: Effect.Effect<SecurityRevision, DrizzleMappingError>;\n  readonly allocateRevisionSync?: () => SecurityRevision;\n  readonly encodeInstant: (epochMillis: number) => unknown;\n  readonly commandRetentionMillis: number;\n  readonly sessionInvalidation: \"same-authority-immediate\" | \"original-absolute-expiry\";\n  readonly isCommandConflict: (cause: unknown) => boolean;\n  readonly isIdentifierConflict: (cause: unknown) => boolean;\n  readonly isCredentialConflict: (cause: unknown) => boolean;\n  readonly d1?: EmailD1Clock;\n}\n\nexport type D1EmailAddressMapping<\n  Subject extends Table,\n  Identifier extends Table,\n  Credential extends Table,\n  AuthorityCredential extends Table,\n  Command extends Table,\n  NativeSubjectId,\n> = EmailAddressMapping<\n  Subject,\n  Identifier,\n  Credential,\n  AuthorityCredential,\n  Command,\n  NativeSubjectId\n> & {\n  readonly d1: EmailD1Clock;\n  readonly subject: EmailSubjectTable<Subject> & { readonly d1ActiveStatusValue: unknown };\n  readonly identifier: EmailIdentifierTable<Identifier, NativeSubjectId> & {\n    readonly d1CurrentCondition: NonNullable<\n      EmailIdentifierTable<Identifier, NativeSubjectId>[\"d1CurrentCondition\"]\n    >;\n    readonly d1MutableTargetCondition: NonNullable<\n      EmailIdentifierTable<Identifier, NativeSubjectId>[\"d1MutableTargetCondition\"]\n    >;\n  };\n  readonly credential: EmailCredentialTable<Subject, Identifier, Credential, NativeSubjectId> & {\n    readonly d1ActiveStatusValue: unknown;\n  };\n  readonly authorityCredential: EmailAuthorityCredentialTable<\n    AuthorityCredential,\n    NativeSubjectId\n  > & { readonly d1ActiveStatusValue: unknown };\n};\n\nexport type EmailRegistrationState = \"pending\" | \"registered\";\n\nexport interface EmailRegistrationIntent<Registration> {\n  readonly moduleId: string;\n  readonly commandId: string;\n  readonly identifier: LoginIdentifier;\n  readonly registration: Registration;\n  readonly fingerprint: TokenDigest;\n  readonly completion: {\n    readonly moduleId: string;\n    readonly purpose: ProofPurpose;\n    readonly continuationId: ProofContinuationId;\n    readonly binding: ProofBinding;\n  };\n}\n\nexport interface EmailRegistrationTable<Registration, Request extends Table, NativeSubjectId> {\n  readonly table: Request;\n  readonly moduleId: ColumnKey<Request>;\n  readonly commandId: ColumnKey<Request>;\n  readonly fingerprint: ColumnKey<Request>;\n  readonly state: ColumnKey<Request>;\n  readonly subjectId: ColumnKey<Request>;\n  readonly pendingReference: ColumnKey<Request>;\n  readonly retentionUntil: ColumnKey<Request>;\n  readonly encodeInsert: (\n    input: EmailRegistrationIntent<Registration>,\n    state: {\n      readonly state: EmailRegistrationState;\n      readonly nativeSubjectId?: NativeSubjectId;\n      readonly pendingReference?: string;\n      readonly retentionUntilMillis: number;\n    },\n  ) => InferInsertModel<Request>;\n  readonly decodeReplay: (\n    row: InferSelectModel<Request>,\n  ) => Effect.Effect<\n    Exclude<EmailRegistrationDecision, { readonly _tag: \"Registered\" }>,\n    DrizzleMappingError\n  >;\n}\n\nexport interface EmailRegistrationProvisioning<\n  Registration,\n  Subject extends Table,\n  NativeSubjectId,\n> {\n  readonly encodeSubjectInsert: (\n    input: EmailRegistrationIntent<Registration>,\n    values: {\n      readonly nativeSubjectId: NativeSubjectId | undefined;\n      readonly securityRevision: SecurityRevision;\n    },\n  ) => InferInsertModel<Subject>;\n  readonly allocateSubjectId?: Effect.Effect<NativeSubjectId, DrizzleMappingError>;\n  readonly allocateSubjectIdSync?: () => NativeSubjectId;\n  readonly decodeGeneratedId?: (\n    rows: ReadonlyArray<unknown>,\n  ) => Effect.Effect<NativeSubjectId, DrizzleMappingError>;\n}\n\nexport interface EmailRegistrationIdentifierTable<Identifier extends Table, NativeSubjectId> {\n  readonly table: Identifier;\n  readonly namespace: ColumnKey<Identifier>;\n  readonly value: ColumnKey<Identifier>;\n  readonly subjectId: ColumnKey<Identifier>;\n  readonly verifiedAt: ColumnKey<Identifier>;\n  readonly bindingRevision: ColumnKey<Identifier>;\n  readonly isCurrent: (row: InferSelectModel<Identifier>) => boolean;\n  readonly d1CurrentCondition?: (input: {\n    readonly identifier: LoginIdentifier;\n    readonly nativeSubjectId: NativeSubjectId;\n    readonly bindingRevision: SecurityRevision;\n  }) => SQL;\n  readonly encodeVerifiedInsert: (input: {\n    readonly identifier: LoginIdentifier;\n    readonly subjectId: NativeSubjectId;\n    readonly verifiedAtMillis: number;\n    readonly bindingRevision: SecurityRevision;\n  }) => InferInsertModel<Identifier>;\n}\n\nexport interface EmailRegistrationCredentialTable<Credential extends Table, NativeSubjectId> {\n  readonly table: Credential;\n  readonly moduleId: ColumnKey<Credential>;\n  readonly subjectId: ColumnKey<Credential>;\n  readonly credentialId: ColumnKey<Credential>;\n  readonly identifierNamespace: ColumnKey<Credential>;\n  readonly identifierValue: ColumnKey<Credential>;\n  readonly credentialRevision: ColumnKey<Credential>;\n  readonly status: ColumnKey<Credential>;\n  readonly isActiveStatus: (value: unknown) => boolean;\n  readonly d1ActiveStatusValue?: unknown;\n  readonly encodeVerifiedInsert: (input: {\n    readonly moduleId: string;\n    readonly subjectId: NativeSubjectId;\n    readonly credentialId: string;\n    readonly identifier: LoginIdentifier;\n    readonly credentialRevision: SecurityRevision;\n  }) => InferInsertModel<Credential>;\n}\n\nexport interface EmailRegistrationAuthorityCredentialTable<\n  Credential extends Table,\n  NativeSubjectId,\n> {\n  readonly table: Credential;\n  readonly subjectId: ColumnKey<Credential>;\n  readonly credentialId: ColumnKey<Credential>;\n  readonly revision: ColumnKey<Credential>;\n  readonly status: ColumnKey<Credential>;\n  readonly isActiveStatus: (value: unknown) => boolean;\n  readonly d1ActiveStatusValue?: unknown;\n  readonly encodeInsert: (input: {\n    readonly subjectId: NativeSubjectId;\n    readonly credentialId: string;\n    readonly revision: SecurityRevision;\n  }) => InferInsertModel<Credential>;\n}\n\nexport interface RequiredEmailRegistrationConstraints extends RequiredEmailSignInConstraints {\n  readonly authorityCredential: \"unique(authorityCredential.subjectId,authorityCredential.credentialId)\";\n  readonly request: \"unique(emailRegistration.moduleId,emailRegistration.commandId)\";\n  readonly pendingReference: \"unique(emailRegistration.pendingReference)\";\n}\n\nexport const requiredEmailRegistrationConstraints: RequiredEmailRegistrationConstraints = {\n  ...requiredEmailSignInConstraints,\n  authorityCredential: \"unique(authorityCredential.subjectId,authorityCredential.credentialId)\",\n  request: \"unique(emailRegistration.moduleId,emailRegistration.commandId)\",\n  pendingReference: \"unique(emailRegistration.pendingReference)\",\n};\n\ntype EmailRegistrationBase<Registration, Request extends Table, NativeSubjectId> = {\n  readonly registration: EmailRegistrationTable<Registration, Request, NativeSubjectId>;\n  readonly constraints: Pick<RequiredEmailRegistrationConstraints, \"request\" | \"pendingReference\">;\n  readonly inspect: (input: {\n    readonly identifier: LoginIdentifier;\n    readonly registration: Registration;\n  }) => Effect.Effect<\n    { readonly fingerprint: TokenDigest; readonly eligible: boolean },\n    DrizzleMappingError\n  >;\n  /** Projects one detached value of the factory-specific Registration Type. */\n  readonly snapshotRegistration: (\n    registration: Registration,\n  ) => Effect.Effect<Registration, DrizzleMappingError>;\n  /** Required by synchronous transaction-bound services. */\n  readonly snapshotRegistrationSync?: (registration: Registration) => Registration;\n  /** Required by synchronous Durable Object transaction-bound services. */\n  readonly inspectSync?: (input: {\n    readonly identifier: LoginIdentifier;\n    readonly registration: Registration;\n  }) => { readonly fingerprint: TokenDigest; readonly eligible: boolean };\n  readonly allocatePendingReference?: Effect.Effect<string, DrizzleMappingError>;\n  readonly allocatePendingReferenceSync?: () => string;\n  readonly encodeInstant: (epochMillis: number) => unknown;\n  readonly retentionMillis: number;\n  readonly isRequestConflict: (cause: unknown) => boolean;\n};\n\nexport type EmailRegistrationMapping<\n  Registration,\n  Subject extends Table,\n  Identifier extends Table,\n  Credential extends Table,\n  AuthorityCredential extends Table,\n  Request extends Table,\n  NativeSubjectId,\n> = EmailRegistrationBase<Registration, Request, NativeSubjectId> &\n  (\n    | {\n        readonly mode: \"atomic\";\n        readonly subject: EmailSubjectReadTable<Subject>;\n        readonly identifier: EmailRegistrationIdentifierTable<Identifier, NativeSubjectId>;\n        readonly credential: EmailRegistrationCredentialTable<Credential, NativeSubjectId>;\n        readonly authorityCredential: EmailRegistrationAuthorityCredentialTable<\n          AuthorityCredential,\n          NativeSubjectId\n        >;\n        readonly subjectId: SubjectIdCodec<NativeSubjectId>;\n        readonly constraints: RequiredEmailRegistrationConstraints;\n        readonly allocateCredentialId?: Effect.Effect<string, DrizzleMappingError>;\n        readonly allocateCredentialIdSync?: () => string;\n        readonly allocateRevision?: Effect.Effect<SecurityRevision, DrizzleMappingError>;\n        readonly allocateRevisionSync?: () => SecurityRevision;\n        readonly isIdentifierConflict: (cause: unknown) => boolean;\n        readonly isCredentialConflict: (cause: unknown) => boolean;\n        readonly provisioning: EmailRegistrationProvisioning<\n          Registration,\n          Subject,\n          NativeSubjectId\n        > &\n          (\n            | {\n                readonly idMode: \"allocated\";\n                readonly allocateSubjectId: Effect.Effect<NativeSubjectId, DrizzleMappingError>;\n              }\n            | {\n                readonly idMode: \"synchronous\";\n                readonly allocateSubjectIdSync: () => NativeSubjectId;\n              }\n            | {\n                readonly idMode: \"generated\";\n                readonly decodeGeneratedId: (\n                  rows: ReadonlyArray<unknown>,\n                ) => Effect.Effect<NativeSubjectId, DrizzleMappingError>;\n              }\n          );\n      }\n    | { readonly mode: \"pending\" }\n  );\n\nexport type AnyEmailSignInMapping = EmailSignInMapping<Table, Table, Table, unknown>;\n\nexport type AnyEmailAddressMapping = EmailAddressMapping<\n  Table,\n  Table,\n  Table,\n  Table,\n  Table,\n  unknown\n>;\n\nexport type AnyEmailRegistrationMapping<Registration = unknown> = EmailRegistrationMapping<\n  Registration,\n  Table,\n  Table,\n  Table,\n  Table,\n  Table,\n  unknown\n>;\n\nexport type D1EmailRegistrationMapping<\n  Registration,\n  Subject extends Table,\n  Identifier extends Table,\n  Credential extends Table,\n  AuthorityCredential extends Table,\n  Request extends Table,\n  NativeSubjectId,\n> = EmailRegistrationMapping<\n  Registration,\n  Subject,\n  Identifier,\n  Credential,\n  AuthorityCredential,\n  Request,\n  NativeSubjectId\n> & { readonly d1: EmailD1Clock };\n"],"mappings":";AAgKA,MAAa,iCAAiE;CAC5E,YAAY;CACZ,cAAc;CACd,sBACE;AACJ;AAqBA,MAAa,kCAAmE;CAC9E,GAAG;CACH,qBAAqB;CACrB,SAAS;AACX;AAqMA,MAAa,uCAA6E;CACxF,GAAG;CACH,qBAAqB;CACrB,SAAS;CACT,kBAAkB;AACpB"}

package/dist/drizzle/email-registration.d.mts

@@ -0,0 +1,33 @@
+import { TokenDigest } from "../Schema.mjs";
+import { LoginIdentifier } from "../identity/models.mjs";
+import "../hooks/LifecycleHooks.mjs";
+import { PreparedCommit } from "../hooks/commit.mjs";
+import { EmailCommandId, EmailRegistrationDecision } from "../email/models.mjs";
+import "./email-model.mjs";
+import { ProofCompletionPlan } from "../proofs/completion.mjs";
+import { EmailUnavailable } from "../email/errors.mjs";
+import { PrepareEmailCommit } from "../email/EmailAddressPersistence.mjs";
+import "./proof-sql.mjs";
+import "./email-sql.mjs";
+import { Effect } from "effect";
+//#region src/drizzle/email-registration.d.ts
+interface EmailRegistrationAuthority<Registration> {
+  readonly inspect: (input: {
+    readonly identifier: LoginIdentifier;
+    readonly registration: Registration;
+  }) => Effect.Effect<{
+    readonly fingerprint: TokenDigest;
+    readonly eligible: boolean;
+  }, EmailUnavailable>;
+  readonly registerWithProof: <A>(input: {
+    readonly moduleId: string;
+    readonly commandId: EmailCommandId;
+    readonly identifier: LoginIdentifier;
+    readonly registration: Registration;
+    readonly fingerprint: TokenDigest;
+    readonly completion: ProofCompletionPlan;
+  }, prepare: PrepareEmailCommit<EmailRegistrationDecision, A>) => Effect.Effect<PreparedCommit<A>, EmailUnavailable>;
+}
+//#endregion
+export { EmailRegistrationAuthority };
+//# sourceMappingURL=email-registration.d.mts.map